So, I accidentally encrypted my device when I booted a kernel that had "force encryption." Ooops. When I rebooted, it immediately started encrypting. (No prompts.)
I tried to decrpyt, but it kept asking me for a password (which I never set up) and then would say that the password was correct (no matter what I typed), but something is corrupted in my data... and that I had to factory reset.
Sure. Bite me, Google!
Steps to recover:
1. Power off
2. Boot into the bootloader
3. Boot into TWRP recovery. TWRP see's all my data fine and doesn't ask for a pw.
4. Backup the phone.
5. Use adb to pull the backup off the phone.
6. Go back into fastboot and run: fastboot format userdata.
7. Boot the phone normally (with a kernel that doesn't force encryption.)
8. (the only reason to boot here is so that android creates the proper /data directory structure.)
7. Back into TWRP...
8. adb again to push the TWRP backup back to the phone
9. Restore the backup made in step 4.
10. Reboot again. Success. Done. Everything works fine and I'm not encrypted.
So much for security, Google. Pfft...
Forgive my ignorance, I am not yet a n6 owner. What, are the disadvantages of encryption?
almahix said:
Forgive my ignorance, I am not yet a n6 owner. What, are the disadvantages of encryption?
Click to expand...
Click to collapse
Read and write speeds are slower as all data is decrypted and then encrypted as it is used.
Sent from my Nexus 7
EverDawn4 said:
Read and write speeds are slower as all data is decrypted and then encrypted as it is used.
Sent from my Nexus 7
Click to expand...
Click to collapse
Also due to the extra number crunching overhead, more battery burning.
I see how that is a negative. I'm surprised there isn't an easier way to disable encryption. I expect by tbe time I get one early next year some awesome dev will resolve that.
The point is that encryption has some negatives, but NO POSITIVES. What is the point of it when its so easily bypassed?
Sent from my Nexus 6
garyd9 said:
The point is that encryption has some negatives, but NO POSITIVES. What is the point of it when its so easily bypassed?
Click to expand...
Click to collapse
Encryption does have some positives, such as more protection of your data. How you describe and what you didnt doesnt show it as having much positives though
You claim it is worthless, because you could use root access and unlocked fastboot to push and pull data and all that, but can you really do all that so easily and get by the encryption without any root access and a locked bootloader? What about a not yet authorized ADB and you cant get into the device because it is locked and encrypted (in this scenario we are trying to break the encryption, not just go into the ROM and hit accept). I think everything is easier when you already have things unlocked and full system access.
Seems pretty secure to me. By the time you got to where you wanted to be, all data on the device was gone.
Mission: Accomplished.
The ONLY requirement to repeat my steps is either an installed custom recovery or an unlocked boot loader.
I'd agree with your argument if google allowed a non-encrypted fs if/when a boot loader was unlocked (which would be simple as /data is formatted on unlock anyway.)
Instead, google forces the encryption unless you swap boot partitions
Who's to say that the boot loader lock can't be worked around by someone determined? We haven't tried yet for the simple reason that the effort seems futile when we can so easily do it with fastboot. However, boot loader locks HAVE been worked around to boot custom recoveries on other devices such as Samsung and LG phones.
Once your in recovery, as I explained above, all the supposedly encrypted data is accessible.
Sent from my Nexus 6
garyd9 said:
The point is that encryption has some negatives, but NO POSITIVES. What is the point of it when its so easily bypassed?
Sent from my Nexus 6
Click to expand...
Click to collapse
It can be bypassed because you are using the default encryption key. If you set a pin or a password it changes the encryption key and you need to enter that in recovery to access the partition.
No positives... Lol
rbox said:
It can be bypassed because you are using the default encryption key. If you set a pin or a password it changes the encryption key and you need to enter that in recovery to access the partition.
Click to expand...
Click to collapse
How many "typical" users will set a pin or password? Those same users, if they are concerned about data security, would be manually enabling encryption already.
Google (and Apple) came up with this "great" idea to force encryption on by default (and, at least in Google's case, make it the ONLY choice without modifying the system boot partition.) They claim they did this to protect data. What protection is there if Google allows the "typical" user to use the "default encryption key" and it's so easy to get the data even if "encrypted?"
I think what I'm getting at here is that I was extremely disappointed that it was so easy for me to get at my "encrypted" data using back door methods. I suspect that MOST people won't set up any extra keys/pins, and will allow the default key. They'll see that the device is "encrypted" and feel some FALSE sense of security. In fact, those people are facing a performance penalty of some degree in order to have that FALSE security.
Here's how I think Google should have done things:
1. First and foremost, don't use software encryption. Require the encryption system to have some form of hardware acceleration.
2. Instead of 'forceencryption', the fs manager should default to encryption ON if the bootloader is locked, and default to OFF if the bootloader is unlocked. The result would be that unlocking the bootloader (which nukes the /data partition and causes it to be reformatted) would start with an un-encrypted userdata partition. (The user could still enable encryption.)
3. In conjunction with #2, if there's no encryption key provided by the user, then DON'T ENCRYPT. I honestly believe that a false security is WORSE than none at all, and apparently the "default" encryption key is all but useless.
On the other hand, I hope my first post in this thread helps some user (or dev) who accidentally encrypts their filesystem while playing with kernels. Up until then, it was believed that once the userdata became encrypted, there was no way to reverse it.
Keep in mind, we XDA users are not typical users so of course we could figure this out. Secondly anyone even remotely interested in security has a password on their phone. Lastly, a question, does encryption prevent people from plugging your phone into a PC and seeing your data?
SymbioticGenius said:
Keep in mind, we XDA users are not typical users so of course we could figure this out. Secondly anyone even remotely interested in security has a password on their phone. Lastly, a question, does encryption prevent people from plugging your phone into a PC and seeing your data?
Click to expand...
Click to collapse
A counter-question: Who (or what) is google trying to "protect" us from with forcing encryption on?
No, encryption doesn't seem to block normal MTP access. Basically, an "encrypted" device (with no password), once booted, appears the same as a non-encrypted device (just a bit slower on data access.) The portion of /data presented as the "internal sd card" is accessible via MTP regardless of if encryption is on or off. (other portions of /data aren't accessible via MTP.)
With adb functional, unix permissions will block quite a bit, and once you add root to the mix, the entire phone can be accessed. (selinux probably introduces more restrictions, but I'm not familiar with them.)
Again, that leads back to the question of just who google is trying to protect us from. If the phone is encrypted (with no password) by default, and can easily be decrypted if no password was provided, then what good is the encryption? Why suffer the overhead of encryption when it doesn't serve any effective purpose?
TWRP tries the default password. If you had changed it, TWRP wouldn't have worked at all.
That was not a fair assessment of the encryption used on Android.
I actually don't think it's a big deal especially since you didn't have a password. Encryption without a password is like a door without a lock.
Also I'm assuming that once a password is active that MTP will be disabled without said password?
Again.... The point is that android is forcing encryption on even without a password. I KNOW I have no password, but if having no password makes encryption useless, why FORCE it to be on?
Sent from my Nexus 6
I think it's better than the current, if you encrypt you must use a password 24/7 mode. I prefer it this way because it's currently how I use my phone. I have a pin when I feel it's necessary (work sometimes, phone charging on a table, bar hopping, etc.) or basically whenever someone might be able to access my phone without my noticing. Otherwise I have my pin off. This works almost exactly how I've been wanting it for years. As long as when my pin is active people can't plug my phone in and view my stuff.
Hi,
I tried to change the pattern of my device, it seems that I didn't set what I thought and now that I restarted my system, the device (Android 7) is asking my for a pattern to let me turn it on, that I don't know.
Of course I'm the owner from this device, with my Google account and everything but I made a misstake and I don't know how to fix it.
What are my options now?, Should I restart the device with recovery options, wiping data user and that or what do I need to do?
Regards in advance.
Do you by any chance have TWRP installed? If so, there are certain files you can delete to remove the pattern.
Try it enough times and it should offer to unlock another way, then use your Google account.
And don't use pattern unlock... PIN an fingerprint are fine.
Trying to determine whether I should decrypt. Encrypted phone requires re-entering the password twice.
Encryption has nothing to do with requiring pin at start up. You can turn it off. And turning off encryption is not something you should do. Anyways to turn start up pin just remove the pin pass or pattern you have currently and then when you add again the first screen that pops up is the confirmation screen asking whether you want startup pin enabled. Select no and you are done..
The only real benefit to decrypting your device is if you use a custom recovery like TWRP--especially if it's not an official build of TWRP.
On some devices (especially those from One Plus) there are issues where TWRP either can't decrypt the data partition or stops being able to decrypt the data partition after an OTA.
On some phones you can just boot back up if that happens but on others you are locked out and need to reformat and reflash just so you can use the device again and if that can't be done which has been the case on some treble phones like the MI-A1 and the Essential PH-1 then your device is permanently bricked and is pretty much just an expensive paperweight.
Hello,
I need help: my note 7 asks me for a PIN when I start the system (Android) and also when I enter TWRP, and I want to remove these PIN requests.
In the 1st rom change (from Miui to pure Android - HavocOS), I did, in the following order:
-format data
-Wipe: system, dalvick, cache and date
When the system started for the first time, I configured the fingerprint sensor together with a 4 digit PIN and it is this PIN that I have to put in the system and the TWRP.
I tested other roms (Bootleggers, crDroid) and it happens the same. I've tried other recoverys, including OrangeFox and the same happens.
I've also tried reinstalling the rom by doing only format data (not doing Wipes) and doing the same.
I received the device with the rom: MIUI 10.3 Stable (10.3.5.0) [PFGMIXM]
The model name is: M1901F7G.
The Android version: 9 PKQ1. 180904.001
What else can I do?
Try not to setup pin after flashing rom and see bro...
I have managed to solve half of the problem: it is no longer encrypted and in TWRP it no longer asks for any PIN.
But on Android I do not accept the PIN that I set up along with the digital print, tell me that it is wrong.
Now the problem is to use PIN + fingerprint. I set up a PIN and when using that same PIN, tell me the PIN is wrong.
If you do not configure PIN, I can not use it without problems, but I lose access to the use of the print sensor
I rooted my device and installed magisk on the stock rom miui 10.3.5 for redmi note 7 will i receive ota updates?
and if not in order to flash newer miui versions of the rom do I need to flash vb meta?
P.Rabbit said:
I have managed to solve half of the problem: it is no longer encrypted and in TWRP it no longer asks for any PIN.
But on Android I do not accept the PIN that I set up along with the digital print, tell me that it is wrong.
Now the problem is to use PIN + fingerprint. I set up a PIN and when using that same PIN, tell me the PIN is wrong.
If you do not configure PIN, I can not use it without problems, but I lose access to the use of the print sensor
Click to expand...
Click to collapse
i am in the same situation man, i don't understand what is the problem and what is wrong...
In my case it was bad configuration, because I set up safe boot and this way I mistakenly assumed that this was related to encryption, but the error was only mine.
Check if you have set safe boot. With safe, always-on boot (a pin, a pattern or a password) every system boot and every time you enter TWRP.
Sorry my English.
Hello there, I'm using OnePlus 6t on OOS 10, somehow my kid changed the lockscreen pin and now forgot.
I've read multiple threads and asked a lot of people, but there seems no method to bypass the lockscreen pin.
I'd some important files which I couldn't backup/ not until my last backup.
Is there any way possible to recover my files after a hard reset as that's the only alternate i can think of without bypassing lockscreen without root.
FYI: Bootloader locked, currently locked, haven't hard reset yet, usb debugging off.
Nope, if you hard reset you lose everything. User storage is encrypted with a per-session key that is wiped when a reset occurs meaning everything on the phone becomes useless garbage the moment that key is lost. If you have adb enabled and have authorized your computer once before you might be able to pull files off using that but otherwise you might be screwed
The lock screen is designed to keep people out, wouldn't be much use if it let people exfiltrate data whenever they wanted
Don't even think you'll be able to get the pin off the phone. When you reset Google asks for the old pin used in the device.
If USB debugging is off, I don't even think you can flash stock firmware onto the device either.
You're pretty much screwed.
The best way to do is MSM tool. If you don't know the password your can't even get in to recovery mode( required password). By doing that all data will be gone.